CVE-2026-120070

Name of the Vulnerable Software and Affected Versions User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission versions prior to 4.3.14

Description Authenticated users with Subscriber-level access and above can escalate their privileges. The issue occurs within the submit post() function via the post content parameter. A discrepancy between how the sanitize textarea field() function and the wp kses() function process data allows an attacker to bypass a shortcode blocklist by injecting a x01 control byte. This enables the injection of a [wpuf-registration role="editor"] shortcode into a published post. When the autologin after registration setting is enabled, this results in the public rendering of a registration form that can be used to create a WordPress Editor account with an active privileged session.

Recommendations Update User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission to version 4.3.14 or later. Disable the autologin after registration setting to prevent immediate privileged session creation upon registration.